Privacy policy

General information

By using this Site, you signify your acceptance of this policy. If you do not agree to this policy, please do not use our Site. Your continued use of the Site following the posting of changes to this policy will be deemed as your acceptance of those changes.

UAB “Sellfy” (hereinafter referred to as “we“ or „data controller“) is a provider of an e-commerce system for selling products online. This Privacy Policy governs the manner in which Sellfy.com collects, uses, maintains and discloses information collected from users (each, a "User") and Clients (each, a "Client") of the https://sellfy.com website ("Site"). This privacy policy applies to the Site, any and all products and services offered on Sellfy.com. For the purpose of this Site: the “User” shall be any person entered onto the Site, including subscribers to our newsletter, and the “Client” shall be any person who has registered with the Site. The terms of these privacy policies apply to you whenever you access the content and / or service we provide, regardless of which device (computer, cell phone, tablet, TV, etc.) you use.

Data controller:
UAB “Sellfy“
Legal entity code: 302673703
Registered office: Pramones g. 97, Vilnius, Lithuania, LT-11115
E-mail: [email protected]

We hereby confirm that your personal data shall be collected in accordance with the requirements of the legal acts of the European Union, the Republic of Lithuania and the instructions of the controlling authorities. All reasonable technical and administrative measures shall be applied in order to protect your personal data from loss, unauthorized use and / or changes of data.

We use a number of outside companies to run Sellfy, and some of them handle personal data on our behalf. Each one is named, with what it does for us and where it is based, on our sub-processors page.

Persons under the age of 16 cannot provide any personal information through our site / social networking accounts. If you are a person below the age of 16, before submitting personal information, you must obtain a consent of your parents or other legal guardians.

The terms used in these rules are understood as defined in the General Data Protection Regulation No. 2016/679 (EU).

It is very important that you carefully read this privacy policy, because each time you visit this Site, you agree to the terms described herein. If you do not agree to these terms, please do not visit our Site, do not use our content and / or services. Click on “Find out more” in each section to find detailed information about the processing of your personal data and the specifics of our business.

How do we collect information about you?

Your personal data, e.g. any information about you that allows us to recognize you is collected in various ways:

you may provide us with information directly (e.g. filling in a form, signing a contract);
we may collect information automatically (e.g. when you access our website, social account, use our apps);
we may acquire information from third parties and collect information about you from publicly available sources (e.g. through Facebook, LinkedIn, your company website or otherwise).

We may collect information that you provide directly. Typically this will happen when you:

register on our website;
sign service or other contract with us;
install our apps;
subscribe to our newsletter or other form of announcements;
participate in surveys.

We may collect information about you automatically. Typically this will happen when you:

submit queries through our website or through our social networking accounts;
use our website (data is collected with the help of cookies and similar technologies);
make public posts on social networking platforms that we are following.

Where permitted by law, we may acquire information about you from third parties. This may be the information provided by our partners, marketing agencies, sponsors, licensors, your public profile information (LinkedIn, Facebook, Twitter, Instagram). We may associate the information we receive about you from yourself, public and commercial sources with other information we receive from you or about you.

We may collect information about you in other cases that are not covered by this Privacy Policy as well. If this happens, we will inform you additionally.

What information about you do we collect?

Registration: Your username, password and e-mail address when you sign-up for a Sellfy account.

User content: Texts, photos, vector and images in other formats, product files in any format you upload them on our site.

Merchant account: If you choose to continue service with Sellfy via a merchant account, we may collect the following personal data from you: credit card number, credit card expiration date, CVV number, billing address and postal code. You may, at your will, also provide your company name, company registration number, full billing address and phone number. This information is used to verify credit card authenticity, and process payments as per your applicable service agreement. To perform services between us and Clients, Clients and their end-customers, we share and process data consisting of payment information with 3rd party payment gateways such as Paypal, Braintree, Stripe and Recurly.

Google Analytics: Sellfy is using Google Analytics to track standard user data on traffic sources, visitor behavior flow, audience overview. We may use your user ID to track specific behavior, however, it cannot be connected to other data we are collecting about the users.

Server logs and Cookies: When you access our services online, our web servers automatically create records of your visit. These records typically include IP-address, access times, the sites linked from, pages visited, the links and features used, the content viewed or requested, browser or application type, and other information of such kind. See also our Information on Cookies usage below.

E-mails:

The email address the Users of the Clients provide for order processing, will only be used to send them information and updates pertaining to their order. It may also be used to respond to their inquiries, and/or other requests or questions. If the User decides to opt-in to our mailing list, they will receive emails that may include company news, updates, related product or service information, etc. If at any time the User would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email or User may contact us via our Site.

Information that we collect automatically will generally concern:

Information about how you use our websites (Device information: i.e. IP address, operating system version and settings for the device you use to access content / products; login information: the usage time and duration of your session, query terms that you enter in our website and any information stored in the cookies we had set on your device (the cookies policy is provided below); location information: i.e. a device`s GPS signal, or information about upcoming Wi-Fi access points and cellular towers that may be passed to us when you use the content of our site.

Information that we collect from third parties or publicly-available sources usually is:

your interests;
your e-mail address, full name, special preferences and interests.

For what purposes do we use information about you, and on what legal basis?

Subject to the above, information is processed for the following purposes:

e-commerce, payments and other related services;
to provide information, which was requested by you, related to the provision of services;
for marketing purposes, e.g. to provide tailor-made advertisements and promotional content and to send reports about promotional activities, to evaluate and analyze market, customers, products and services (including collecting your opinion on products and services, organizing customers / partners surveys, contests or promotional activities to the extent permitted by law);
to find out how people use our online services in order to improve them and create new content, products and services;
to defend our interests in court or in other institution;

The legal basis for our use of information about you is one or several of the following:

compliance with legal obligations to which we are subjects;
performance of the contract with you;
a legitimate business interest that is not overridden by interests you have to protect the information;
in certain cases, your consent.

The purposes for which we use information about you, with corresponding methods of collection and legal basis for use are presented in this table.

PURPOSE	LEGAL BASIS FOR PROCESSING	PERSONAL DATA
To provide e-commerce, payment and other related services	To provide our services for you. To comply with legal obligations to which we are subjects. A legitimate business interest that is not overridden by interests you have to protect the information.	username, password, credit card number, credit card expiration date, postal code, IP address, other information that may be required for service such as your phone or e-mail for sending confirmation of services, user content uploaded, photos, images, vectors, product files, information about your interests and specific needs.
To provide information, which was requested by you, related to the provision of services	To provide accurate information about our services, availability of services, and related information, etc.	In order to answer your inquiries by e-mail, social networking environment and other ways, we can ask for your e-mail address or other convenient method of contact.
For marketing purposes, e.g., to provide tailor-made advertisements and promotional content and to send reports about promotional activities, to evaluate and analyze market, customers, products and services (including collecting your opinion on products and services, and organizing customer surveys).	To inform you about our services, events, news and other relevant information.	Social network account details, e-mail, your interests.
To find out how people use our online services in order to improve them and create new content, products and services.	To monitor the quality of the services provided, develop and improve the content that we provide, and ensure the security of the website.	IP address, operating system version and parameters of the device you use to access content / products, the usage time and duration of your session, query terms that you enter on our website, and any information stored in the cookies that we have detected on your device, GPS signal of the device, or information about the closest Wi-Fi access points and cellular towers that may be passed to us when you are using our website content.
Defend our interests in court of other institution	Compliance with legal obligations to which we are subjects Legitimate interest to defend against claims and pretenses.	Depending on the claim or pretense, we may handle all of your personal data contained in our possession in these privacy policies.

Where we do not base our use of information about you on one of the above legal bases, we will ask for your consent before we process the information (these cases will be clear from the context).

In some instances, we may use information about you in ways that are not described above. Where this is the case, we will provide a supplemental privacy notice that explains such use. You should read any supplemental notice in conjunction with this notice.

Who do we share your information with?

We may share information about you:

With companies that provide services on our request.
With payment gateways to process payments or receive payment information.
With banks / companies that assist in payment transactions.
With companies that help organize competitions / games / promotions.
With other responsible selected business partners.
With other third parties, where required or permitted by law, or is necessary to protect our legitimate interests.
With other entities upon your consent.

The companies that handle personal data on our behalf – for hosting, payments, support, email and analytics – are listed on our sub-processors page, together with what each one does for us and where it is based. We keep that page up to date as we add or replace a vendor. The ability of these companies to use your information is limited. They cannot use this information other than for the purposes of providing services for us.

Other third parties that may be provided with our available information about you when it is necessary to protect our legitimate interests are the governmental authorities, institutions that supervise e-commerce and payment activities, pre-trial investigation officers, courts, etc.

AI assistants you connect to Sellfy

You can connect your store to an AI assistant, such as Claude or ChatGPT, through Sellfy's MCP server. When you approve the connection on Sellfy's sign-in screen, the assistant can read your products, orders, customers, reviews, email campaigns and storefront content, including buyer names and email addresses, and can make the changes you ask it to. Whatever a tool returns is sent to the provider of the assistant you connected and handled under that provider's terms. Sellfy sends nothing to that provider outside a conversation you start. A connection expires after 30 days without use or 180 days in total, and you can end it at any time by disconnecting it in the assistant or by changing your Sellfy password.

Where might information about you be sent?

When using information as described in this notice, information about you may be transferred either within or outside the country or territory where it was collected, including to a country or territory that may not have equivalent data protection standards. In such cases, we do our best to ensure the security of your personal data being transmitted.

The data controller sends your personal data to the following countries outside the European Economic Area: United States, United Kingdom, Canada, Israel.

When we send your personal data to countries outside the European Economic Area, we make sure that one of the following security measures are applied:

the agreement signed with the data recipient is based on the Model Clauses approved by the European Commission;
in case of transferring data to a group of companies, BCR apply;
the data recipient is located in a country that is recognized by the European Commission as applying adequate data protection standards;
authorization from the Data Protection Inspectorate.

How do we protect information about you?

We adopt effective and appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your personal information, username, password, transaction information and data stored on our Site. However, keep in mind that while we are taking appropriate action to protect your information, no website, online transaction, computer system or wireless connection is completely safe.

How long will information about you be kept?

We will retain information about you for the period necessary to fulfill the purposes for which the information was collected. After that, we will delete it, unless applicable legal acts obliges us to store information for tax purposes, or data may be required for pre-trial investigation, but in any case, the retention period will be no more than 10 years. When this term expires, the data will be deleted in such a way that it cannot be restored.

Typically, personal data is stored in the following terms:

Payment records - 10 years after the payment transaction
Marketing records - 3 years after your last visit to our website
IT system records (logs) - Up to several months
Business analytics - Business analytics data is typically collected automatically when you use our website and anonymised / aggregated shortly afterwards.

What rights do you have?

The data subject whose data is processed by the data controller, depending on the situation, has these rights:

to be informed about personal data being processed (right to be informed);
to access personal data and get information about how personal data is being processed (right to access);
to obtain from the controller the rectification of inaccurate personal data concerning data subject and have the right to have incomplete personal data completed (right to rectification);
to erase personal data or suspend data processing activities (except storage) (right to erase and right to be “forgotten”);
to require the data controller to restrict the processing of personal data for one of the legitimate reasons (right to restriction of processing);
to transmit personal data to another controller (right to data portability);
to object at any time to processing of personal data concerning data subject which is based on the performance of a task carried out in the public interest or for the purposes of the legitimate interests pursued by the controller or by a third party. In order for the controller to process personal data, he is responsible to prove that the processing is conducted for legitimate reasons and those reasons are beyond the interests of the data subject;
lodge a complaint with the supervisory authority in your country.

We offer you easy ways to exercise these rights. You can do this by writing to us at [email protected], or by using certain links at the bottom of the promotional content provided by us.

We may not give you the conditions for the implementation of the above mentioned rights, where in the cases provided by the law, it is necessary to ensure the prevention of crimes, offenses of professional or ethical conduct, as well as to ensure the protection of the rights and freedoms of the data subject or other persons.

Your rights will be fulfilled once your identity is confirmed live, by electronic signature or, if these two options are not possible, remotely via online call.

YOUR RIGHT	CERTAIN LIMITATIONS
Right to be informed	Before processing your personal data, you have the right to receive information about processing of your data in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
Right to access	This is confirmation of: – whether or not we process information about you; – submitting a list of your personal data we manage; – the purpose and legal grounds of the processing; – of whether we are sending data to third parties and if so, what security measures we have taken. – the categories of persons with whom we share your personal data; – the existence of automated decision-making, including profiling, that produces legal effects concerning you, or significantly affects you in a similar way, and information about the logic involved, as well as the significance and the envisaged consequences of such processing for you; – provision of data storage time. Upon identification of your identity, we will provide you the information listed above, if such information will not violate the rights and freedoms of other persons.
Right to rectify or update personal data	This applies if the information we hold is inaccurate or incomplete.
Right to erase personal data (Right to be “forgotten”)	This applies if: – the information we hold is no longer necessary in relation to the purposes for which we use it; – we use the information on the basis of your consent and you withdraw your consent; – we use the information on the basis of legitimate interest and we find that, following your objection, we do not have an overriding interest in continuing to use it; – the information was unlawfully obtained or used.
Right to restrict the processing of personal data (except storage)	This right applies temporarily while we look into your case, if you: – contest the accuracy of information we use; – have objected to our using the information on the basis of legitimate interest; – our use is unlawful and you oppose the erasure of the data; – we no longer need the data, but you require it to establish a legal case.
Right to object	You can exercise this right: – if we use information about you for direct marketing: you can “opt out” (without the need to justify it) and we will comply with your request; – if we use the information about you on the basis of legitimate interest for purposes other than direct marketing, you can object to our using it for those purposes, giving an explanation of your particular situation, and we will consider your objection, unless legitimate grounds for processing will override the interests, rights and freedoms of the data subject.
Right to data portability	This right can be implemented if you have provided data to us and we use that data, by automated means, and on the basis either of your consent, or on the basis of discharging our contractual obligations to you.
Lodge a complaint with the supervisory authority in your country	https://www.ada.lt/

Cookies, signals and similar technologies

In this Privacy Policy we use the term "cookies" for cookies and other similar technologies, such as Pixel Tags, Web Beacons and clear GIFs. Cookies are small items of information stored in your web browser. They keep you signed in, remember the language you read the site in, and let us count visits and see which pages people use, so that we can improve them.

The cookies in the first table are set without asking you, because the site does not work without them. Everything in the other three tables runs only if you accept it in our cookie banner, and you can change your mind there at any time.

Needed to run the site

COOKIE	WHAT IT DOES	KEPT FOR
session	Keeps you signed in and keeps your cart and checkout working.	1 day
rmmbr	Keeps you signed in after you close the browser, if you ticked "Remember me".	7 days
access_token_cookie	Keeps a buyer signed in to their customer account on a store.	24 hours
store_version	Keeps a seller on the draft version of their store while they preview it.	24 hours
CookieConsent, cookietest	Cookiebot. Remembers the cookie choice you made, so you are not asked again.	1 year
_cfuvid	Cloudflare. Tells real visitors from bots and limits abuse of the site.	Browser session
_GRECAPTCHA, rc::a, rc::b, rc::c, rc::f	Google reCAPTCHA. Checks that forms are not being filled in automatically.	Up to 180 days
dmn_chk_#	Dub. Checks which domain a shared link came from.	Browser session

Your preferences

COOKIE	WHAT IT DOES	KEPT FOR
locale	Remembers the language you chose for the site, a store or checkout.	2 years

Analytics

COOKIE	WHAT IT DOES	KEPT FOR
_ga, _ga_2CKX0FMHTP	Google Analytics. Counts visits and shows how pages are used.	2 years
ph_*	PostHog. Shows how the seller dashboard is used.	1 year
astro_session	Anonymous ID that links a signup back to the page you arrived from.	180 days
ABUID	Anonymous ID used for A/B tests and store page-view counts.	30 days
Loom video cookies	Set by Loom videos embedded on our pages (ajs_anonymous_id, statsig.*, sentryReplaySession and others).	Session to 1 year

Marketing

COOKIE	WHAT IT DOES	KEPT FOR
_gcl_au, _gcl_aw, _gcl_ls, test_cookie	Google Ads. Measures what our ads lead to.	Up to 90 days
growSumoPartnerKey, ps_partner_key, ps_xid	PartnerStack. Credits the partner who referred you.	90 days
dub_id, dub_partner_data	Dub. Credits the partner link you came through.	90 days
invite, Sellfy.Tracking.Inviter	Remembers who invited you, so they get credit when you sign up.	30 days
affiliate	Credits the affiliate whose link brought a buyer to a store.	Set by the seller, 1 to 90 days
YouTube video cookies	Set by YouTube videos embedded on our pages (VISITOR_INFO1_LIVE, YSC and others).	Session to 180 days
ttwid	Set by TikTok content embedded on our pages.	1 year

Seller storefronts (addresses ending in sellfy.store, and sellers' own domains) do not load our analytics or marketing tags. Buyers there only get the cookies needed to run the site, the language cookie, and the affiliate cookie if they arrived through an affiliate link. A seller may add their own tools to their store; those are covered by that seller's own policy.

Most browsers let you accept all cookies, refuse them, or warn you before one is stored, and your device may have its own controls as well. Turning cookies off means parts of Sellfy will stop working. To learn more, see allaboutcookies.org.

The third parties named above set their own cookies through our site, and their own privacy policies apply to those. Our social media accounts follow the cookie policies of the networks they are on.

Final provisions

This Privacy Policy applies for this Site only. Users may find content on our Site that link to the sites and services of our Clients, partners, suppliers, advertisers, sponsors, licensors and other third parties. We do not control the content or links that appear on these sites and are not responsible for the practices employed by websites linked to or from our Site. In addition, these sites or services, including their content and links, may be constantly changing. These sites and services may have their own privacy policies and customer service policies. Browsing and interaction on any other website, including websites which have a link to our Site, is subject to that website's own terms and policies.

We have the discretion to update this Privacy Policy at any time. When we do, we will inform you about such changes and the most up-to-date version of this policy.

Contacting us

If you have any questions about this Privacy Policy, the practices of this site, or your dealings with this site, please contact us at: [email protected] This Privacy Policy is subject to the Law of the Republic of Lithuania.

Privacy Policy